Fixes: Assertion width > 0 && width <= 32 failed Fixes: 71012/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_METADATA_fuzzer-6073354744823808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> --- libavcodec/cbs_h265_syntax_template.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/libavcodec/cbs_h265_syntax_template.c b/libavcodec/cbs_h265_syntax_template.c index 12fa185c774..d23cb58e863 100644 --- a/libavcodec/cbs_h265_syntax_template.c +++ b/libavcodec/cbs_h265_syntax_template.c @@ -2307,6 +2307,10 @@ SEI_FUNC(sei_3d_reference_displays_info, (CodedBitstreamContext *ctx, RWContext else length = FFMAX(0, (int)current->exponent_ref_display_width[i] + (int)current->prec_ref_display_width - 31); + + if (length > 32) + return AVERROR_PATCHWELCOME; + if (length) ubs(length, mantissa_ref_display_width[i], 1, i); else @@ -2318,6 +2322,10 @@ SEI_FUNC(sei_3d_reference_displays_info, (CodedBitstreamContext *ctx, RWContext else length = FFMAX(0, (int)current->exponent_ref_viewing_distance[i] + (int)current->prec_ref_viewing_dist - 31); + + if (length > 32) + return AVERROR_PATCHWELCOME; + if (length) ubs(length, mantissa_ref_viewing_distance[i], 1, i); else -- 2.46.0 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
